Pharaoh's Party: Coin Pusher - Customized SSL, WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Pharaoh's Party: Coin Pusher published at the 'play' market has multiple vulnerabilities...

Coin Party: Carnival Pusher - Customized SSL, WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Coin Party: Carnival Pusher published at the 'play' market has multiple vulnerabilities...

Coinbase: Transactions visible on Unconfirmed devices

Pusher authentication did not take device confirmation into account. This would allow an attacker with a valid session but an unconfirmed device to snoop on pusher updates like incoming transactions. This issue was in the coinbase event notification Pusher, which allowed me to read notification o...

CVE-2012-5813

The CVE-2012-5813 entry concerns the Android_Pusher library for Android where TLS hostname verification is not performed against the server certificate’s CN/subjectAltName. This omission enables man-in-the-middle attackers to spoof SSL servers using an arbitrary valid certificate. The available s...

PT-2012-6125

Name of the Vulnerable Software and Affected Versions Android Pusher library for Android affected versions not specified Description The issue concerns a lack of verification in the Android Pusher library that the server hostname matches a domain name in the subject's Common Name CN or...